Insecure network exposure

What it is

A server that binds to `0.0.0.0` or an internet-routable IP with TLS disabled, or with `NODE_TLS_REJECT_UNAUTHORIZED=0`, or with a self-signed certificate the client was configured to blindly accept. Anyone on the network path can read the tool arguments (which often contain tokens or private data) and modify tool results.

Why it matters for MCP

Development defaults matter. An MCP server that worked on `localhost` is often deployed with the same `app.listen(3000)` to a public host. Because most transport is JSON over HTTP/SSE, there is no built-in confidentiality at that point.

Vulnerable example

import http from "node:http";

// Plain HTTP on a public interface

const server = http.createServer(handler);

server.listen(3000, "0.0.0.0");

Secure example

import https from "node:https";

import fs from "node:fs";

const server = https.createServer(

  {

    key: fs.readFileSync("/etc/ssl/private/key.pem"),

    cert: fs.readFileSync("/etc/ssl/certs/cert.pem"),

    minVersion: "TLSv1.3",

  },

  handler,

);

server.listen(3000, "127.0.0.1"); // only reachable via reverse proxy

How MCPSafe detects this

We flag HTTP listeners without TLS when the bind address is not loopback, and any use of `NODE_TLS_REJECT_UNAUTHORIZED=0`, `verify=False`, or equivalent TLS-disabling flags.

See the full threat catalog for every documented detection.

Framework alignment

OWASP LLM Top-10 (2025)

LLM02 — Sensitive Information Disclosure

OWASP Agentic AI Top-10

T09 — Identity Spoofing

AIVSS v0.5

7.4 (HIGH)AIVSS:1.0/S:HIGH/AV:A/AU:N/BR:H/CD:D

Further reading

• CWE-319: Cleartext Transmission of Sensitive Information
• Mozilla TLS config guide